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1. Introduction 



Quantum error-correction will be an essential building-block for the physical im- 
plementation of a quantum computer since it is unlikely that the coherence time 

\& • of a quantum mechanical system is long enough to perform any computation of 

interest, such as factoring large numbers (see Shor 1994). The last years have seen 
a great progress in the theory of quantum error-correcting codes (see, e.g., Knill & 
Laflamme 1997; Calderbank et al. 1998). The algorithmic aspect of encoding and 

^^ ■ decoding, however, has hardly been addressed, yet. 

Cleve & Gottesman (1997) gave a general construction for encoding circuits, 
but not for decoding. Beth & Grassl (1998) illustrated how to derive decoding 
circuits for quantum error-correcting codes in general. In this paper, we present 
a technique for encoding and decoding tailored to cyclic quantum error-correcting 
codes. The resulting quantum circuits are based on the quantum version of linear 
feed-back shift registers. Hence, these circuits possess a highly regular structure and 
are especially suited for systems with inherent cyclic symmetries, e.g., circular ion 
traps. Linear feed-back shift registers fit also to a heterogeneous system — such as 
optically trapped atoms combined with a cavity — where one part of the system — 
$2j ■ e.g., the cavity — acts as bus for the feed-back. 

The paper is organised as follows: Assuming that the reader is familiar with 
the concept of quantum computation in general (see, e.g., Berthiaume (1997); 
Steane (1998a)), we start with an introduction to (classical) cyclic error-correcting 
codes. Then we present linear shift registers, firstly in their classical, secondly in 
their quantum version. In §5 quantum circuits for encoding and decoding cyclic 
quantum-error correcting codes are presented. We conclude with an illustrating 
example and final remarks. 

2. Cyclic Codes 

In this section we recall some properties of (classical) cyclic codes. A good reference 
is, e.g., Mac Williams & Sloane (1977). 
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(a) Polynomial Description 

A cyclic code C — [N,K] q of length N and dimension K over a finite field 
¥ q = GF(q) is a K -dimensional subspace of F^ that is invariant under cyclic 
shifting the coordinates, i.e., for a codeword c = (c ,... ,Cjv-i), the cyclic shift 
(cjv-1i c 0; • • • ! c/v-2) is again a codeword. To any codeword c = (c , . . . , Cjv-i) we 
associate the code polynomial c(X) := c + C\X + . . . + cn-iX n ~ x = X^ c *-^*- 
Cyclic shifting the codeword c corresponds to multiplication of the polynomial 
c(X) by X and reducing it modulo X N — 1. Furthermore, any linear combination 
of codewords — and thus code polynomials — is again a codeword. Altogether, the 
code corresponds to an ideal in the ring ¥ q [X]/(X N — 1). This ideal is generated by 
(the residue class of) a polynomial g(X) of degree N — K, the generator polynomial 
of C. Hence, any code polynomial c(X) can be written as 

c(X) = i(X)g(X) mod X N - 1. (2.1) 

It can be shown that g(X) may be chosen as the unique monic non-zero polynomial 
of least degree in the code and that g(X) divides X N — 1, thus g n = g(0) 7^ 0. The 
set of code polynomials is given by 

{c(X) :ceC} = {i(X)g(X) | deg i(X) < K}. (2.2) 

(b) The Dual of Cyclic Codes 
For a linear block code C of length N over a field ¥ q , the dual code C x is given 

by 

C 1 - := {v e Ff I Vc G C : c • w = 0}. 

Here c • v := ^\ avi is the usual inner product of the vectors c and v. 

Obviously, the dual of a cyclic code is cyclic, too. The generator polynomial 
g^{X) of the dual code is given by 

g^(X) = h Q 1 h rcv (X) where g(X)h(X) = X N - 1. (2.3) 

(Note that ho 7^ since h(X)\X N — 1.) Here /i rcv (X) denotes the reciprocal poly- 
nomial of h(X) = ^ li hiX 1 obtained by reversing the sequence of coefficients, i.e., 

V CV (X) := h a X d ^ h ^+... + h dcgh{X) X° 
= X dcsh{x) h(l/X). 

(c) The Syndrome of Cyclic Codes 

There are several ways to check whether a given vector r resp. polynomial r(X) 
is an element of a cyclic code C. From equation (2.1), any code polynomial is a 
multiple of the generator polynomial g(X). Therefore the syndrome polynomial 
s(X) can be defined as 

s(X) :=r(X) modg(X). (2.4) 

The syndrome polynomial is zero if and only if r £ C, and its degree is less than 
N — K otherwise. 
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Another way to check whether a polynomial r(X) belongs to a code C generated 
by g(X) is the following: Recall that h(X) = (X N - l)/g(X) and that every 
codeword is a multiple of g{X). Hence h(X) can be used as a check polynomial 
with 

r(X) eC ^=> r(X)h(X) = mod (X N - 1). (2.5) 

(d) Weakly Self-Dual Cyclic Codes 

The construction of quantum error-correcting codes presented in §5 is based on 
weakly self-dual classical codes, i.e., codes C with C < C x . For cyclic codes, a code 
C\ with generator polynomial g\(X) is contained in the code C^ with generator 
polynomial gi(X) iff g2(X) divides g\(X). Thus a cyclic code with generator poly- 
nomial g(X) is weakly self-dual iff the generator polynomial g ± (X) = hQ 1 h ICV (X) 
of the dual code divides g(X). In combination with equation (2.3) we get the fol- 
lowing identities: 

g\X) = h^h^(X); 

g(X) = g ± (X)g(X); (2.6) 

X^-l = hv l h rcv {X)g{X)h{X). (2.7) 

For a cyclic code C — [N, K] of length N and dimension K, the degrees of the 
polynomials are as follows: 

degg ± (X) = K- 

degg{X) = N-K; 
degg(X) = N-2K. 

Next we characterise weakly self-dual cyclic codes in terms of the factorisation 
of X N — 1 into irreducible polynomials over the field W q . As X N — 1 is (up to a 
constant) a self-reciprocal polynomial, for any factor f(X) of X N — 1, f rcv (X) is 
a factor as well. Hence we can write the factorisation of X N — 1 as 

xN i = n^wn^wn^rw 

j i i 

where the polynomials Vj(X) are the (up to a constant) self-reciprocal factors. From 
equation (2.7) follows that h(X) and h rov (X) have no common factor, hence each 
of the self-reciprocal polynomials Vj(X) is a factor of g(X), i.e., 

Y[rj(X):=r(X) and r(X)\g(X). (2.8) 

j 

Furthermore, for each i at least one of the polynomials Pi(X) and p\ cv (X) is a 
factor of g(X). 

We conclude this section by a statement about the weights of the codewords of 
weakly-self dual cyclic binary codes. 

Theorem 2.1. Any weakly self-dual cyclic binary code of odd length is doubly even, 
i.e., the weight of any codeword is divisible by four. 
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Proof. The generator polynomial of the code C can be written as 

w 

g(X) = Y^ xd% where d i = ° < d 2 < • • • < d w < N. (2.9) 

i=i 

The dual code C 1 - has generator polynomial g ± (X) = h rcv (X), and its check 
polynomial is (X N - l)/h rcv (X) = g rcv {X). From C <C^ and equation (2.5) we 
obtain 

f(X) := g(X)g™(X) = a(X){X N - 1). 

From equation (2.8) follows that r(X) 2 \g(X)g rcv (X) and thus r(X)\a(X), in par- 
ticular, (X + l)\a(X). Hence the number of terms in a(X) is even. The degree of 
g(X) is less than N, and therefore the degree of a(X) is less than N, too. This im- 
plies that in the summation X N a(X) — a(X) no terms cancel each other, showing 
that the number of terms in f(X), denoted by #f, is divisible by four. 
On the other hand, from equation (2.9), f(X) can be written as 

w I w \ w 

f(X) =J2 xd * X d ™J2x- d i = X d ™ Y X di - d K (2.10) 

Again from equation (2.8), we conclude that (X + l)\g(X), and thus the number 
of terms w of g(X) is even. Hence for i = j all terms X di ~ dj in the summation 
(2.10) cancel each other. For the remaining w(w — 1) terms, two terms cancel each 
other iff rfj — dj = dk — di- But then we have also dj — di = d\ — dk , so in total four 
terms are cancelled. Hence #/ = w(w — 1) — Am for some integer m. We already 
know that #f is divisible by four. Therefore w(w — 1) must also be divisible by 
four which implies that w is divisible by four since w — 1 is odd. 

From equation (2.2) follows that {X l g(X) : i — 0, . . . , TV — d w — 1} is a vector 
space basis of the code. The weight of each of these vectors is divisible by four. 
Being a weakly self-dual code, the inner product of any two codewords is zero, i.e., 
the number of common ones is even. This implies that the weight of the sum of two 
codewords which are doubly-even is again divisible by four. (For the last implication 
see also MacWilliams & Sloane (1977), Ch. 1, §8, Problem (38).) □ 

This theorem shows that allf quantum error-correcting codes derived from weakly 
self-dual cyclic binary codes are well suited for fault-tolerant quantum computing 
(cf. Gottesman 1998). This is reflected by the fact that these codes admit the bitwise 

implementation of the operation P = I . ] (see Steanc (19986), Lemma 4). 

3. Cyclic Codes and Linear Shift Registers 

The basic operations related to cyclic codes are polynomial multiplication and di- 
vision. Both can be done using linear shift registers. 

f Steane (19986) observed that the dual of some primitive narrow sense BCH codes turn out 
to be doubly even. At the CCP workshop at the Isaac Newton Institute, Cambridge, July 1999, 
he discussed with us the question when a cyclic code is doubly even. 
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(a) Polynomial Multiplication 
From Horner's rule, the multiplication of a polynomial i(X) — Y]j—n ijX J by 
the (fixed) polynomial g(X) = X^=o 9i^ can ^e written as 



(Ui^x + i^)x + ...)x + io)g(x) 

{i»g{X)X + i^_ l9 (X))X + . . . ) X + i g(X). 



i(X)g(X) 



Feeding the sequence i M , z M -i, ... , io, 0, 0, . . . (starting with i M ) into the shift reg- 
ister shown in figure 1 with the register cells initialised with zero, it outputs the 
coefficients of i(X)g(X), starting with the coefficient of X d+tl . 



output 




input 



-o 



•$- 



clocked IFg-adder multiplication 

Fg-rcgistcr-ccll by a £ ¥ q 

Figure 1. Circuit diagram for a linear feed-forward shift register to multiply the input by 

g(X). 

From equation (2.1) we see that in order to generate a codeword of a cyclic 
code with generating polynomial g(X), we just multiply a polynomial i{X) by 
g(X) modulo X N — 1. From equation (2.2) follows that the degree of i{X) can be 
chosen to be less than K . Then, reduction modulo X N — 1 is not necessary since 
the degree of the product is less than N . Thus from the circuit shown in figure 1 
we can construct a circuit with N register cells that computes c(X) = i(X)g{X) 
in K steps starting with the initialisation shown in figure 2. 











1 
















Figure 2. Circuit diagram for encoding a cyclic code of length iV and dimension K with 

generator polynomial g(X). 

One single step of the shift register corresponds to the linear mapping given by 
(r' , . . . , r' N _ 1 ) = (r , . . . , nv-i) ■ E 
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/ 1 



E = 



o\ 



••• 

\go gi 



9d 



•• 
1 
0/ 



The matrix E can be factored into a cyclic shift and adding multiples of the 
first element to several others as follows: 



/0 1 ••• 0\ 



E 



'•• '•• 

o 1 

Vi o ••• o o/ 



(go g\ ■■■ 
o l o 



!)■! 



••• 0\ 





\o 



'•. 

1/ 



Since the code does not change if we multiply the generator polynomial by a non- 
zero constant, we can assume without loss of generality go = 1 (note that go =/= 0) 
thereby simplifying the second factor. 
The K th power of E is given by 



/ 



1 



E 



K 



\ 



,0,i 



go 


.91 




,9rf 






go 


.91 


,9o 


,9rf 
.91 


0, • 


' ' i 


IK- 


i)E 


K 



!l,i 



showing that indeed (0, 
thus c e C. 

Similarly, it can be shown that for the initialisation (jo , 
after K steps the state of the shift register corresponds to 



c with c(X) = i(X)g(X) and 

jd-l,«0) • ■ • , lK-l), 



p(X)=i(X)g(X)+X K j(X) 



(3.1) 



where j(X) - j d -\X 



<i-i 



Jo- 



(b) Polynomial Division 



Similar to shift registers for polynomial multiplication, shift registers can be 
constructed for polynomial division. The circuit shown in figure 3 implements a 
polynomial division by a monic polynomial g(X) of degree d. Feeding the sequence 
fiii fn-ii ■ ■ ■ > /o (starting with f^) into the shift register shown in figure 3 with 
the register cells initialised with zero, it outputs the coefficients of f(X)divg(X), 
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d-l 



input 



*® 



-T ► 

I outpu 



Figure 3. Circuit diagram for a linear feed-back shift register to divide the input by the 

monic polynomial g(X). 

starting with the coefficient of X^~ d . After fx + 1 steps, the contents of the register 
cells are the coefficients of f(X) mod g(X). 

To obtain the syndrome of a cyclic code (cf. equation (2.4)), we have to compute 
the remainder of the polynomial r(X) modulo g(X). Since the degree of r(X) is 
less than N, we can use the circuit shown in figure 4 with TV register cells initialised 
with (ro, . . . , rjv-i)- After N steps, the first d = N — K register cells contain the 
remainder r(X) mod g(X), and the last K registers contain r(X) div g(X). 















ro 




r\ 











-®-~ 



rx+l — 



*£ft — ► rw-i 1 1 

I 



Figure 4. Circuit diagram for computing the quotient r(X) div g(X) and the remainder 
r(X) mod g(X) of the polynomials r(X) and g(X) of degree less than N and d, resp. 

The corresponding matrix is given by 

/0 1 ••• 0\ 



S 



■■ •■ 

o 1 

Vi o ... o o/ 



■s 2 



where 



/ 1 ... -go -.9i • • • -ga-i \ 



S 2 



V 



i / 



If we are only interested in the remainder and want to keep the original poly- 
nomial r(X), a slightly modified version of the previous circuit can be used (cf. 
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r-s. 





















j~I — ^~n ° I ' 9 i ° I ^\ ° I — i 

io j fgi) ■ ■ ■ (gd-i) 

t t t 



Figure 5. Circuit diagram for syndrome computation for a cyclic code of length N with 
(monic) generator polynomial g(X) of degree d. 

figure 5). After N steps, the first N register cells contain again r(X), and the last 
d register cells contain r(X) mod g(X). As before, this transformation can be fac- 
tored into a shift operation — with two disjoint cycles of length N and d — and a 
simple linear mapping. 

4. Quantum Shift Registers 

In this section we show how the linear shift registers presented in the previous 
section can be transformed into quantum circuits. For both linear feed- forward 
shift registers (for polynomial multiplication) and linear feed-back shift registers 
(for polynomial division) a single basic step can be decomposed into a cyclic shift 
followed by a linear mapping of the form 



/ 1 m 2 m 3 . . . m N \ 



V 



(4-1) 



i 7 



First we consider how two implement these mappings for shift registers over 
the binary field F 2 , then for shift registers over any field of characteristic two, 
i.e., over F 2 t. In this paper, we restrict ourselves to fields of characteristic two — 
corresponding to qubits — , but the results can easily be generalised to any charac- 
teristic p > 0. 



(a) Binary Quantum Shift Registers 



(i) Cyclic Shifting 



For binary shift register in each cell we have the values zero or one. Thus we 
replace each cell by one quantum bit (qubit). The shift register circuits shown in 
figures 2, figure 4, and 5 do all operations in place, i.e., have no input and output. 
Therefore, the state of the whole shift register can be represented by N (resp. N+d) 
qubits. 

The first part of the basic step of a linear shift register is a cyclic shift of the 
qubits. This corresponds to the permutation n — (1 2 . . . N) which can be written 
as product of transpositions 



(1 2 ... N) = (N-l N)...(2 3)(1 2) 

= (1 N-l)(2 N-2)...(i N-i). 
•(1 N)(2 N-T)...(i N+l-i) 



(4.2) 



(4.3) 
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(here the leftmost transposition is applied first). While in the first factorisation 
there are only transpositions of neighbouring numbers, the second factorisation is a 
product of two permutations each of which is a product of disjoint transpositions. 
A transposition of two qubits — a SWAP gate — can be implemented with three 
controlled not (CNOT) gates as shown in figure 6. (For the graphical notation of 
quantum operations see, e.g., Barenco et al. 1995.) 



-^> 



-e- 



-e 



Figure 6. Quantum circuit to swap two qubits. 



In figure 7 the circuits corresponding to the factorisations in equation (4.2) and 
equation (4.3) resp. are presented for seven qubits. Both circuits have the same 
number of CNOT gates, namely 3(N — 1), but the second one has only (constant) 
depth six if CNOT gates on disjoint sets of qubits can be performed in parallel. 
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Figure 7. Quantum circuits for cyclic shifting, corresponding to the different 
factorisations of the permutation n — (123456 7) given in equation (4.2) and 

equation (4.3) resp. 

Note that particular systems may admit simpler implementations of a single 
SWAP gate (Sanders et al. 1999) or the complete cyclic shift. 

(ii) Linear Feed-Forward/Feed-Back 

The second part of the basic step of a shift register is the linear transformation 
given in equation (4.1). The first register cell is unchanged, while multiples of the 
contents of the first register cell are added to the other cells. For binary shift 
registers, either the value of the first register is added or nothing is done. The 
addition of a binary value can be implemented easily, it corresponds to a CNOT 
gate. The quantum circuit corresponding to the linear feed-forward shift register 
for multiplication by the polynomial g(X) = X 3 + X + 1 is shown in figure 8. The 
shift operation is depicted as a black-box (see figure 7) . The two CNOT gates after 
each shift correspond to the terms X 3 and X in g(X). 

An alternate version of this circuit can be obtained if instead of cyclic shifting 
the qubits, the other operations are shifted and the output qubits are re-labelled, 
as shown in figure 9. Furthermore, we have combined CNOT gates with the same 
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Figure 8. Quantum circuit corresponding to K — 4 steps of a quantum linear 
feed-forward shift register for multiplication by the polynomial g(X) — X A + X + 1. 



control qubit since these gates could be realised with fewer operations, e.g. 
linear ion trap where the control qubit is put on the phonon bus. 



in a 



In) 

l<2> 
1*3) 
1*4) 

l<5> 
l«> 

Hr) 
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G — T 

— ° — T — 
— 4 ® 

o — 



|05> 

\o 6 ) 
|07> 
|oi> 

l«> 

l°3> 



Figure 9. Alternate version of the quantum circuit shown in figure 8. 



(6) Quantum Shift Registers over Extension Fields 
(i) Finite Fields of Characteristic Two 

First, we recall some facts about finite fields (see, e.g., Jungnickel 1993). 

Any finite field ¥ q has q = p k elements where p is a prime number, the charac- 
teristic of the field. The smallest subset of ¥ q that is a field is called the prime field 
of F q and has p elements. Conversely, the field ¥ q is an extension field of F p . It can 
be constructed as ¥ p [X]/(f(X)) where f(X) € ¥ p [x] is an irreducible polynomial 
of degree k. The extension field ¥ q is a vector space of dimension k over F p , and 
thus possesses a basis of k linearly independent elements. For a fixed basis B, any 
element of ¥ q can be represented by a vector of length k over F p . The multiplication 
by a fixed element a € ¥ q is a linear mapping and can thus be written as a k x k 
matrix Ms(a) over ¥ p . The trace of M^a) is independent of the choice of the basis 
and defines an F p -linear mapping 



fc-i 



tr:F„ 



F 



v 



tr(a;) := tr(M B (x)) = ^ x v% 



(for the last equality see, e.g., Gciselmann (1994), Satz 1.24). 

Finally, we need the definition of the dual basis. Given a basis B = (6i, . . . , bk) of 
a finite field ¥ q as F p -vector space, the dual basis is another basis B — (b[, . . . , b' k ) 
with 

\/i,j: tT(bib'j) = Sij. 

Such a dual basis exists for any basis, and the dual basis is unique (see Jung- 
nickel (1993), Theorem 4.1.1). A basis that equals its dual basis is called self-dual. 
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(ii) Cyclic Shifting 

For binary shift register each cell was represented by one qubit. Fixing a basis 
B, each element of the field F 2 fc can be represented by a binary vector of length 
k. Hence each cell of the quantum shift register over the field F 2 fc is represented 
by k qubits. Cyclic shifting over the extension field is implemented similarly to 
the binary case, but now shifting is performed in parallel in blocks of size k. The 
complexity increases only by the factor k, i.e., shifting can be done with 3k(N — 1) 
CNOT gates. The parallelised version has again constant depth six. 



(iii) Linear Feed-Forward/Feed-Back 

For the second part of the basic step of a shift register we have to implement 
the linear transformation given in equation (4.1). Multiples of the contents of the 
first register cell are added to the other cells, i.e., we have to implement the trans- 
formations 

\x)i\y)i i-» \x)i\m l x + y)i 

for fixed values rnt £ ¥ 2 k . Writing the field elements x and y as binary vectors of 

length k with respect to the basis B = (&i, . . . , bk), the multiplication by mi is a 

linear transformation given by the matrix M := Mg(mj). Now the transformation 

can be written as 

k / k \ 



nitX + y 




Mjixi + yj bj 



where all operations in parentheses are over the binary field. This translates directly 
into a quantum circuit as demonstrated by the following example. 

We consider the field F 2 3 with basis B — (a 3 , a 6 , a 5 ) where a 3 + a + 1 = 0. 
Elements of Fs are written as binary column vectors. Multiplication by m 2 := a 
corresponds to (left) multiplication of the column vectors by 



M B (a) 




(4.4) 



The quantum circuit for the transformation |x)|y) i— ► |x)|aa; + y) is shown in fig- 
ure 10. Conditioned on Xi, the ith column of Mg(a) is added to the vector y = 
(l/i) 2/2) Vzf ■ The total number of CNOT gates in the circuit is at most k+ (ft— l) 2 = 
k 2 — k + 1 since the matrix M is either zero or has full rank which implies that at 
most one column (resp. row) contains no zero. 



I*i> 

l*2> 
l*3> 
lift) 
|W> 
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1 y ' ' 

«. 

4 e 

— 4 4 4 
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\ x 3) 

\y[) 
\y' 2 ) 
\vk) 



Figure 10. Quantum circuit implementing the transformation |a;)|j/) i— * \x)\ocx + y). 
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5. Cyclic Quantum Codes 

(a) Binary Codes 

Wc follow the construction of quantum error-correcting codes from weakly self- 
dual binary codes presented by Calderbank & Shor (1996) and Steane (1996a, b). 
In the literature, these codes are also referred to as CSS codes. 

Given a weakly self-dual linear binary code C — [N, K] , the basis states of the 
corresponding quantum code are given by 

VIM ce c 

where {wj : j = 1, . . . , 2 N ~ 2K } is a system of representatives of the cosets C /C. 
For cyclic codes, the vector c + Wj corresponds to the polynomial c(X) + Wj(X). 
Since c E C and Wj <G C , we have 

c(X) = i(X)g(X) and 
Wj (X) = j(X)g ± (X) 

for suitably chosen i(X) and j(X). From equation (2.6) we get g(X) = g(X)g J ~(X) 
and thus 

c{X)+w i {X) = (i{X)~g{X)+j{X))g A -{X). (5.2) 

Combining equations (5.1) and (5.2), wc obtain 

l^) = 7= E \{i{X)g{X)+j{X))g\X)) (5.3) 

^ dcgi(X)<K 

where for the polynomial f(X) = f + f 1 X + ... + f N ^X N -\ \f(X)) denotes the 
state |/o)|/i)...|/jv-i) • 

Asj(X) is a representative of a coset of the code generated by g(X), without loss 
of generality we can reduce j(X) modulo g(X) and obtain deg j(X) < dcgg(X) = 
N — 2K. Hence we get orthogonal basis states \ipj) of the code parameterised by 
all polynomials j(X) with &cgj(X) < N-2K. The polynomials i(X)g(X) +j(X) 
correspond to elements of the cosets of the cyclic code C. Thus the state \ipj) 
does not change if we cyclically shift the qubits, i.e., multiply the polynomial by 
X N ~ 2K mod (X N — 1). Hence equation (5.3) can be written in the (unnormaliscd) 
form 

|^) = J2 | (* POsPO + X N - 2K j(X))g^(X)) (5.4) 

dcgi{X)<K 

which can be directly translated into an encoding algorithm. 

(b) Encoding and Decoding 

(i) Encoding 

First, we show how to encode quantum information using quantum shift regis- 
ters. The initial state of N — 2K qubits is embedded into N qubits as follows: 

|0o)= £ a J -|0)...|0)|j(X))|0)...|0). 

dc g j(X)<N-2K V £ "T^T K ' 
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Hadamard transformation of the last K qubits yields the state 



]T aj \0)\J(X))\i(X)), 



dcgi(X)<K 
degj(X)<N-2K 

where we have omitted the overall normalisation factor. Using a quantum linear 
shift register of length N — K (on the last N — K qubits) for the multiplication by 
g(X), we get (cf. equation (3.1)) 



I 02 



J2 a J \0)i{X)g{X) + X N ^ K j(X) 



dcgi(X)<K 
dcgj(X)<N-2K 



Finally in order to multiply by g- L (X) we use a quantum shift register of length N 
and obtain the desired state (cf. equation (5.4)) 



]T aj (i(X)g(X) + X N -™j{X))g^{X) 



(5.5) 



dcgi(X)<K 
degj(X)<N-2K 

The whole encoding process is sketched in figure 11. 

\<h) \<h 

|0) 



K qubits < 



|0>- 



q) < N - 2 K qubits < 



|0>- 



"&h 



K qubits < 



|0>- 





m- Li 




i 



9(X) 



9 ± (X) 



Figure 11. Quantum circuit for encoding a cyclic quantum-error correcting code using 
quantum linear shift registers for multiplication by g(X) and g ± (X). 



(ii) Decoding 

The general outline of the decoding procedure for CSS codes is shown in fig- 
ure 12. First, errors corresponding to tensor products of identity and the Pauli 
matrix a x (bit-flip errors) are corrected. Then, a Hadamard transformation inter- 
changes phase-flip errors (corresponding to cr z ) with respect to the original basis and 
bit-flip errors with respect to the transformed basis. For quantum error-correcting 
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Figure 12. General decoding scheme for a quantum error-correcting code constructed 
from a weakly self-dual binary code. 

codes derived from weakly self-dual binary codes, both steps are essentially the 
same. Therefore, we describe only the first step. 

The error-free state (5.5) is a superposition of codewords of the cyclic code 
generated by g ± (X). Hence computing the syndrome s(X) = r(X) modg ± (X) 
(cf. equation (2.4)) yields information about the error. For the computation of the 
remainder r(X) modg^(A), we use the quantum version of the linear feed-back 
shift register shown in figure 5. The degree of g ± (X) is K, therefore we need K 
auxiliary qubits for the syndrome. The N qubits of the (erroneous) encoded state 
are successively fed into the shift register, as depicted in figure 13. After N steps, 
the K auxiliary qubits contain the syndrome of the bit-flip errors. At this point, a 
classical binary syndrome can be obtained by measuring the K syndrome qubits. 
Then, the corresponding error can be determined using classical algorithms (e.g., 
the Berlekamp-Massey algorithm, see Mac Williams & Sloane (1977)). Alternatively, 
the error may be corrected using quantum operations that are conditioned on the 
state of the syndrome qubits. 



N qubits < 




K qubits < 



Figure 13. Computing the syndrome of a cyclic quantum error-correcting code using a 
quantum linear feed-back shift register. 
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(c) Codes over Fields of Characteristic Two 

Grassl et al. (1999) showed that CSS codes can also be constructed using non- 
binary classical codes. The main idea is to map a code over an extension field F 2 fc 
to a code over the prime field F2, as described in the following definition. 

Definition 5.1. Let C = [N,K] 2 k be a linear code over the field F 2 fc with basis 
B = (h,...,b k ). 

Then the binary expansion of C with respect to the basis B is the linear binary 
code C2 — [kN, kK] 2 given by 



C 2 



{(^eF 2 feJV \c=(E j c ij b j ),€C} 



The relations between the codes in the previous definition and their duals are 
reflected by the following theorem. 

Theorem 5.2 (see Grassl et al. 1999). Let C = [N, K] 2 be a linear code over 
the field ¥ 2 k and let C be its dual. Then the dual code of the binary expansion 
of C with respect to the basis B is the binary expansion of the dual code C with 
respect to the dual basis B , i.e., the following diagram commutes: 



C — > C 



_L 



basis B 



dual basis B 



c 2 — > a 

This theorem shows in particular that the binary code inherits the property of 
being weakly self-dual from the code over the extension field if the binary expansion 
is with respect to a self-dual basis (see §4 6(i)). 

If we start with a weakly self-dual cyclic code over the extension field, the same 
principles as for cyclic binary codes can be used for encoding and decoding. We 
just have to replace the quantum linear shift registers over the binary field by shift 
registers over extension fields (see §4 6(ii) and (in)). 

6. Example 

To illustrate the preceding, we present quantum circuits based on quantum shift- 
registers for quantum Reed-Solomon (Q1ZS) codes (Grassl et al. 1999). 

We construct a Q1ZS code from a Reed-Solomon code C = [7, 3, 5]§ over the 
field Fg. The generator polynomial is 

g{X) = (X - a°)(X - a^iX - a 2 )(X - a 3 ), 

where a 3 + a + 1 = as above. The dual code C 1 - — [7, 4, 4]§ is generated by 

g ± (X) = (X - a- 4 ){X - a- 5 ){X - a' 6 ) 
= (X - a 3 )(X - a 2 )(X - a 1 ) 
= a 6 (aX 3 +X 2 + a 2 X + l). 

Hence C <C^ and g{X) = (X - l)g-'-(X). 
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As self-dual basis of Fg over F2 we choose B = (a 3 , a 6 , a 5 ). The binary expan- 
sions of C and C 1 - yield binary codes C 2 = [21,9,8] 2 and C£ = [21,12,5] 2 . Thus 
the QRS code has parameters C = [[21, 3, 5]]. 

The encoding circuit shown in figure 14 has the same structure as that in fig- 
ure 11. First, the 3-qubit state ( l q-octet r ) \<p) is embedded into 21 qubits (or 7 
q-octets) forming the state \4>o)- Next, three steps of the quantum shift register 
for the multiplication by g(X) = X + 1 follow. In figure 14, the shift operation 
is depicted by a permutation of the lines representing the qubits. Finally, we have 
four steps of the quantum shift register for the multiplication by g- L {X). We make 
the normalisation go = 1 and obtain g J -(X) = aX 3 + X 2 + a 2 X + 1. The matrices 
corresponding the multiplication by the non-trivial coefficients of g (X) are given 
by 

/ 1 1 \ / 1 

M B (a) =111 and M B {a 2 ) =011 

\0 1 0/ \ 1 1 1 

As in equation (4.4) and figure 10, the structure of this matrices is reflected by the 
quantum circuit. 




Figure 14. Encoder for the quantum Reed- Solomon code [[21, 3, 5]] using quantum shift 



registers for the multiplication by g(X) — X + 1 and g 



al°+r+a X + l. 



The quantum circuit in figure 14 strictly follows the concept of cyclic shifting and 
linear feed-back. Hence it is highly structured. On the other hand, if shifting cannot 
be implemented easily, we can re-shuffle the circuit and simplify it by combining 
all shift operations to a permutation of the input (see figure 15). 

7. Conclusion 

In this paper, we presented new methods for encoding and decoding cyclic quantum 
error-correcting codes based on quantum linear shift registers. They may ease the 
physical implementation of quantum computers. 
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Figure 15. Alternate version of the encoder shown in figure 14. 

Classically, linear feed-back shift registers are also used to produce pseudo ran- 
dom sequences for cryptographic purposes. Hence, it is worthwhile to investigate the 
cryptographic properties of quantum states produced by quantum linear feed-back 
shift registers (QLFSR). 

Another application of (classical) linear shift registers is the area of convolutional 
codes. Therefore, the quantum version of linear shift registers might prove useful 
in the context of quantum convolutional codes (Chau 1998), too. 

The authors would like to thank Willi Geiselmann for numerous stimulating discus- 
sions during the process of writing this paper. We are indebted to Rainer Steinwandt 
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